Author: tfaber Date: Sun Jun 11 06:05:42 2017 New Revision: 74990
URL: http://svn.reactos.org/svn/reactos?rev=74990&view=rev Log: [WIN32K:NTUSER] - Include the CLIPBOARDDATA structure itself when calculating the size passed to UserCreateObject in IntSynthesizeDib. Fixes user heap corruption when running user32_winetest:clipboard. CORE-13408
Modified: trunk/reactos/win32ss/user/ntuser/clipboard.c
Modified: trunk/reactos/win32ss/user/ntuser/clipboard.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/user/ntuser/clipboa... ============================================================================== --- trunk/reactos/win32ss/user/ntuser/clipboard.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/user/ntuser/clipboard.c [iso-8859-1] Sun Jun 11 06:05:42 2017 @@ -180,7 +180,7 @@ NULL, &hMem, TYPE_CLIPDATA, - cjDataSize); + sizeof(CLIPBOARDDATA) + cjDataSize); if (!pClipboardData) { goto cleanup;